SourceCodester Lost and Found Information System GET Parameter sql injection

Vulnerability

The vulnerability resides in the admin/?page=items/view_item endpoint of SourceCodester Lost and Found Information System version 1.0. The id GET parameter is passed unsanitized into a SQL query, allowing an attacker to inject arbitrary SQL commands. Proof-of-concept imagery has been publicly disclosed [1].

Exploitation

An attacker can exploit this remotely without authentication by sending a crafted HTTP GET request to the vulnerable endpoint with malicious SQL in the id parameter. The exploit has been publicly released [1], making the attack trivial to reproduce.

Impact

Successful exploitation allows an attacker to read, modify, or delete arbitrary data in the underlying database, potentially exposing sensitive information such as user credentials, personal details, and application secrets. The vulnerability is rated critical (CVSS 9.8) [1].

Mitigation

No official patch has been released as of the publication date (2023-05-14). Users should restrict network access to the application, apply input validation on the id parameter, or migrate to an alternative solution if the vendor does not provide a fix. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.